npm - @azure/msal-browser - Versions diffs - 4.27.0 → 4.28.1 - Mend

@azure/msal-browser 4.27.0 → 4.28.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (376) hide show

package/lib/msal-browser.cjs CHANGED Viewed

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.27.0 2025-12-04 */
+/*! @azure/msal-browser v4.28.1 2026-01-17 */
 'use strict';
 'use strict';
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -279,7 +279,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -296,7 +296,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -345,7 +345,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -445,7 +445,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -702,7 +702,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -741,7 +741,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -932,12 +932,12 @@ class Logger {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.13.3";
+const version$1 = "15.14.1";
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -957,7 +957,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1015,7 +1015,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1163,7 +1163,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1260,7 +1260,7 @@ class StringUtils {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1455,7 +1455,7 @@ class ScopeSet {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1495,7 +1495,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1577,7 +1577,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1592,7 +1592,7 @@ const AuthorityType = {
     Ciam: 3,
 };
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1614,7 +1614,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1638,7 +1638,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1672,6 +1672,13 @@ class AccountEntity {
      * Returns the AccountInfo interface for this account.
      */
     static getAccountInfo(accountEntity) {
+        const tenantProfiles = accountEntity.tenantProfiles || [];
+        // Ensure at least the home tenant profile exists
+        if (tenantProfiles.length === 0 &&
+            accountEntity.realm &&
+            accountEntity.localAccountId) {
+            tenantProfiles.push(buildTenantProfile(accountEntity.homeAccountId, accountEntity.localAccountId, accountEntity.realm));
+        }
         return {
             homeAccountId: accountEntity.homeAccountId,
             environment: accountEntity.environment,
@@ -1683,7 +1690,7 @@ class AccountEntity {
             nativeAccountId: accountEntity.nativeAccountId,
             authorityType: accountEntity.authorityType,
             // Deserialize tenant profiles array into a Map
-            tenantProfiles: new Map((accountEntity.tenantProfiles || []).map((tenantProfile) => {
+            tenantProfiles: new Map(tenantProfiles.map((tenantProfile) => {
                 return [tenantProfile.tenantId, tenantProfile];
             })),
             dataBoundary: accountEntity.dataBoundary,
@@ -1784,7 +1791,14 @@ class AccountEntity {
         account.cloudGraphHostName = cloudGraphHostName;
         account.msGraphHost = msGraphHost;
         // Serialize tenant profiles map into an array
-        account.tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
+        const tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
+        // Ensure at least the home tenant profile exists
+        if (tenantProfiles.length === 0 &&
+            accountInfo.tenantId &&
+            accountInfo.localAccountId) {
+            tenantProfiles.push(buildTenantProfile(accountInfo.homeAccountId, accountInfo.localAccountId, accountInfo.tenantId, accountInfo.idTokenClaims));
+        }
+        account.tenantProfiles = tenantProfiles;
         account.dataBoundary = accountInfo.dataBoundary;
         return account;
     }
@@ -1859,7 +1873,7 @@ class AccountEntity {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1940,7 +1954,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2056,7 +2070,7 @@ function normalizeUrlForComparison(url) {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2220,7 +2234,7 @@ class UrlString {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2359,7 +2373,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2367,7 +2381,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2412,7 +2426,7 @@ function createCacheError(e) {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2582,15 +2596,16 @@ class CacheManager {
      * @param cacheRecord {CacheRecord}
      * @param correlationId {?string} correlation id
      * @param kmsi - Keep Me Signed In
+     * @param apiId - API identifier for telemetry tracking
      * @param storeInCache {?StoreInCache}
      */
-    async saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache) {
+    async saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache) {
         if (!cacheRecord) {
             throw createClientAuthError(invalidCacheRecord);
         }
         try {
             if (!!cacheRecord.account) {
-                await this.setAccount(cacheRecord.account, correlationId, kmsi);
+                await this.setAccount(cacheRecord.account, correlationId, kmsi, apiId);
             }
             if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
                 await this.setIdTokenCredential(cacheRecord.idToken, correlationId, kmsi);
@@ -3522,7 +3537,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3779,6 +3794,11 @@ const PerformanceEvents = {
     Decrypt: "decrypt",
     GenerateEarKey: "generateEarKey",
     DecryptEarResponse: "decryptEarResponse",
+    LoadExternalTokens: "LoadExternalTokens",
+    LoadAccount: "loadAccount",
+    LoadIdToken: "loadIdToken",
+    LoadAccessToken: "loadAccessToken",
+    LoadRefreshToken: "loadRefreshToken",
 };
 const PerformanceEventAbbreviations = new Map([
     [PerformanceEvents.AcquireTokenByCode, "ATByCode"],
@@ -4044,7 +4064,7 @@ const IntFields = new Set([
     "upgradedCacheCount",
 ]);
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4123,7 +4143,7 @@ class StubPerformanceClient {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4223,7 +4243,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4233,7 +4253,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4283,7 +4303,7 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4663,7 +4683,7 @@ function addPostBodyParameters(parameters, bodyParameters) {
     });
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4675,7 +4695,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4685,7 +4705,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4695,7 +4715,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4791,7 +4811,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4897,7 +4917,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4962,7 +4982,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5224,7 +5244,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6063,7 +6083,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6094,7 +6114,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6113,7 +6133,7 @@ class ServerError extends AuthError {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6134,7 +6154,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6221,7 +6241,7 @@ class ThrottlingUtils {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6252,7 +6272,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6400,7 +6420,7 @@ class BaseClient {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6428,7 +6448,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     uxNotAllowed: uxNotAllowed
 });
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6518,7 +6538,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6590,7 +6610,7 @@ class ProtocolUtils {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6672,7 +6692,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6699,7 +6719,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6763,7 +6783,7 @@ class ResponseHandler {
      * @param serverTokenResponse
      * @param authority
      */
-    async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
+    async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, apiId, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.HandleServerTokenResponse, serverTokenResponse.correlation_id);
         // create an idToken object (not entity)
         let idTokenClaims;
@@ -6811,14 +6831,19 @@ class ResponseHandler {
             if (handlingRefreshTokenResponse &&
                 !forceCacheRefreshTokenResponse &&
                 cacheRecord.account) {
-                const key = this.cacheStorage.generateAccountKey(AccountEntity.getAccountInfo(cacheRecord.account));
-                const account = this.cacheStorage.getAccount(key, request.correlationId);
-                if (!account) {
+                const cachedAccounts = this.cacheStorage.getAllAccounts({
+                    homeAccountId: cacheRecord.account.homeAccountId,
+                    environment: cacheRecord.account.environment,
+                }, request.correlationId);
+                if (cachedAccounts.length < 1) {
                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
+                    this.performanceClient?.addFields({
+                        acntLoggedOut: true,
+                    }, request.correlationId);
                     return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
                 }
             }
-            await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, isKmsi(idTokenClaims || {}), request.storeInCache);
+            await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, isKmsi(idTokenClaims || {}), apiId, request.storeInCache);
         }
         finally {
             if (this.persistencePlugin &&
@@ -6888,6 +6913,9 @@ class ResponseHandler {
                     ? parseInt(serverTokenResponse.refresh_token_expires_in, 10)
                     : serverTokenResponse.refresh_token_expires_in;
                 rtExpiresOn = reqTimestamp + rtExpiresIn;
+                this.performanceClient?.addFields({
+                    ntwkRtExpiresOnSeconds: rtExpiresOn,
+                }, request.correlationId);
             }
             cachedRefreshToken = createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token, this.clientId, serverTokenResponse.foci, userAssertionHash, rtExpiresOn);
         }
@@ -7030,7 +7058,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7048,7 +7076,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7070,8 +7098,9 @@ class AuthorizationCodeClient extends BaseClient {
      * API to acquire a token in exchange of 'authorization_code` acquired by the user in the first leg of the
      * authorization_code_grant
      * @param request
+     * @param apiId - API identifier for telemetry tracking
      */
-    async acquireToken(request, authCodePayload) {
+    async acquireToken(request, apiId, authCodePayload) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientAcquireToken, request.correlationId);
         if (!request.code) {
             throw createClientAuthError(requestCannotBeMade);
@@ -7083,7 +7112,7 @@ class AuthorizationCodeClient extends BaseClient {
         const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin, this.performanceClient);
         // Validate response. This function throws a server error if an error is returned by the server.
         responseHandler.validateTokenResponse(response.body);
-        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId);
+        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, authCodePayload, undefined, undefined, undefined, requestId);
     }
     /**
      * Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
@@ -7283,7 +7312,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7298,7 +7327,7 @@ class RefreshTokenClient extends BaseClient {
     constructor(configuration, performanceClient) {
         super(configuration, performanceClient);
     }
-    async acquireToken(request) {
+    async acquireToken(request, apiId) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireToken, request.correlationId);
         const reqTimestamp = nowSeconds();
         const response = await invokeAsync(this.executeTokenRequest.bind(this), PerformanceEvents.RefreshTokenClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(request, this.authority);
@@ -7306,13 +7335,13 @@ class RefreshTokenClient extends BaseClient {
         const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
         const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
         responseHandler.validateTokenResponse(response.body);
-        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId);
+        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, undefined, undefined, true, request.forceCache, requestId);
     }
     /**
      * Gets cached refresh token and attaches to request, then calls acquireToken API
      * @param request
      */
-    async acquireTokenByRefreshToken(request) {
+    async acquireTokenByRefreshToken(request, apiId) {
         // Cannot renew token if no request object is given.
         if (!request) {
             throw createClientConfigurationError(tokenRequestEmpty);
@@ -7327,7 +7356,7 @@ class RefreshTokenClient extends BaseClient {
         // if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
         if (isFOCI) {
             try {
-                return await invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true);
+                return await invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true, apiId);
             }
             catch (e) {
                 const noFamilyRTInCache = e instanceof InteractionRequiredAuthError &&
@@ -7338,7 +7367,7 @@ class RefreshTokenClient extends BaseClient {
                     e.subError === Errors.CLIENT_MISMATCH_ERROR;
                 // if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)
                 if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {
-                    return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false);
+                    return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false, apiId);
                     // throw in all other cases
                 }
                 else {
@@ -7347,26 +7376,30 @@ class RefreshTokenClient extends BaseClient {
             }
         }
         // fall back to application refresh token acquisition
-        return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false);
+        return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false, apiId);
     }
     /**
      * makes a network call to acquire tokens by exchanging RefreshToken available in userCache; throws if refresh token is not cached
      * @param request
      */
-    async acquireTokenWithCachedRefreshToken(request, foci) {
+    async acquireTokenWithCachedRefreshToken(request, foci, apiId) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
         // fetches family RT or application RT based on FOCI value
         const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined, this.performanceClient);
         if (!refreshToken) {
             throw createInteractionRequiredAuthError(noTokensFound);
         }
-        if (refreshToken.expiresOn &&
-            isTokenExpired(refreshToken.expiresOn, request.refreshTokenExpirationOffsetSeconds ||
-                DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS)) {
-            this.performanceClient?.addFields({ rtExpiresOnMs: Number(refreshToken.expiresOn) }, request.correlationId);
-            throw createInteractionRequiredAuthError(refreshTokenExpired);
+        if (refreshToken.expiresOn) {
+            const offset = request.refreshTokenExpirationOffsetSeconds ||
+                DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS;
+            this.performanceClient?.addFields({
+                cacheRtExpiresOnSeconds: Number(refreshToken.expiresOn),
+                rtOffsetSeconds: offset,
+            }, request.correlationId);
+            if (isTokenExpired(refreshToken.expiresOn, offset)) {
+                throw createInteractionRequiredAuthError(refreshTokenExpired);
+            }
         }
-        // attach cached RT size to the current measurement
         const refreshTokenRequest = {
             ...request,
             refreshToken: refreshToken.secret,
@@ -7377,11 +7410,10 @@ class RefreshTokenClient extends BaseClient {
             },
         };
         try {
-            return await invokeAsync(this.acquireToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest);
+            return await invokeAsync(this.acquireToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest, apiId);
         }
         catch (e) {
             if (e instanceof InteractionRequiredAuthError) {
-                this.performanceClient?.addFields({ rtExpiresOnMs: Number(refreshToken.expiresOn) }, request.correlationId);
                 if (e.subError === badToken) {
                     // Remove bad refresh token from cache
                     this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache");
@@ -7492,7 +7524,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7590,7 +7622,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7605,7 +7637,7 @@ const StubbedNetworkModule = {
     },
 };
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7829,7 +7861,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7887,7 +7919,7 @@ class AuthenticationHeaderParser {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8150,7 +8182,7 @@ class ServerTelemetryManager {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8158,7 +8190,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8183,7 +8215,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8223,7 +8255,7 @@ class JoseHeader {
     }
 }
-/*! @azure/msal-common v15.13.3 2025-12-04 */
+/*! @azure/msal-common v15.14.1 2026-01-17 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9311,9 +9343,9 @@ const InMemoryCacheKeys = {
 };
 /**
  * API Codes for Telemetry purposes.
- * Before adding a new code you must claim it in the MSAL Telemetry tracker as these number spaces are shared across all MSALs
  * 0-99 Silent Flow
  * 800-899 Auth Code Flow
+ * 900-999 Miscellaneous
  */
 const ApiId = {
     acquireTokenRedirect: 861,
@@ -9325,6 +9357,30 @@ const ApiId = {
     acquireTokenSilent_silentFlow: 61,
     logout: 961,
     logoutPopup: 962,
+    hydrateCache: 963,
+    loadExternalTokens: 964,
+};
+/**
+ * API Names for Telemetry purposes.
+ */
+const ApiName = {
+    861: "acquireTokenRedirect",
+    862: "acquireTokenPopup",
+    863: "ssoSilent",
+    864: "acquireTokenSilent_authCode",
+    865: "handleRedirectPromise",
+    866: "acquireTokenByCode",
+    61: "acquireTokenSilent_silentFlow",
+    961: "logout",
+    962: "logoutPopup",
+    963: "hydrateCache",
+    964: "loadExternalTokens",
+};
+const apiIdToName = (id) => {
+    if (typeof id === "number" && id in ApiName) {
+        return ApiName[id];
+    }
+    return "unknown";
 };
 /*
  * Interaction type of the API - used for state and telemetry
@@ -10340,7 +10396,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.27.0";
+const version = "4.28.1";
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12360,17 +12416,21 @@ class BrowserCacheManager extends CacheManager {
         if (!parsedAccount || !AccountEntity.isAccountEntity(parsedAccount)) {
             return null;
         }
+        this.performanceClient.addFields({
+            accountCachedBy: apiIdToName(parsedAccount.cachedByApiId),
+        }, correlationId);
         return CacheManager.toObject(new AccountEntity(), parsedAccount);
     }
     /**
      * set account entity in the platform cache
      * @param account
      */
-    async setAccount(account, correlationId, kmsi) {
+    async setAccount(account, correlationId, kmsi, apiId) {
         this.logger.trace("BrowserCacheManager.setAccount called");
         const key = this.generateAccountKey(AccountEntity.getAccountInfo(account));
         const timestamp = Date.now().toString();
         account.lastUpdatedAt = timestamp;
+        account.cachedByApiId = apiId;
         await this.setUserData(key, JSON.stringify(account), correlationId, timestamp, kmsi);
         const wasAdded = this.addAccountKeyToMap(key, correlationId);
         this.performanceClient.addFields({ kmsi: kmsi }, correlationId);
@@ -13125,7 +13185,7 @@ class BrowserCacheManager extends CacheManager {
      * @param request
      */
     async hydrateCache(result, request) {
-        const idTokenEntity = createIdTokenEntity(result.account?.homeAccountId, result.account?.environment, result.idToken, this.clientId, result.tenantId);
+        const idTokenEntity = createIdTokenEntity(result.account.homeAccountId, result.account.environment, result.idToken, this.clientId, result.tenantId);
         let claimsHash;
         if (request.claims) {
             claimsHash = await this.cryptoImpl.hashString(request.claims);
@@ -13137,7 +13197,7 @@ class BrowserCacheManager extends CacheManager {
          *
          * The next MSAL VFuture should map these both to same value if possible
          */
-        const accessTokenEntity = createAccessTokenEntity(result.account?.homeAccountId, result.account.environment, result.accessToken, this.clientId, result.tenantId, result.scopes.join(" "),
+        const accessTokenEntity = createAccessTokenEntity(result.account.homeAccountId, result.account.environment, result.accessToken, this.clientId, result.tenantId, result.scopes.join(" "),
         // Access token expiresOn stored in seconds, converting from AuthenticationResult expiresOn stored as Date
         result.expiresOn
             ? toSecondsFromDate(result.expiresOn)
@@ -13150,7 +13210,7 @@ class BrowserCacheManager extends CacheManager {
             idToken: idTokenEntity,
             accessToken: accessTokenEntity,
         };
-        return this.saveCacheRecord(cacheRecord, result.correlationId, isKmsi(extractTokenClaims(result.idToken, base64Decode)));
+        return this.saveCacheRecord(cacheRecord, result.correlationId, isKmsi(extractTokenClaims(result.idToken, base64Decode)), ApiId.hydrateCache);
     }
     /**
      * saves a cache record
@@ -13158,9 +13218,9 @@ class BrowserCacheManager extends CacheManager {
      * @param storeInCache {?StoreInCache}
      * @param correlationId {?string} correlation id
      */
-    async saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache) {
+    async saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache) {
         try {
-            await super.saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache);
+            await super.saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache);
         }
         catch (e) {
             if (e instanceof CacheError &&
@@ -13919,7 +13979,7 @@ class InteractionHandler {
      * Function to handle response parameters from hash.
      * @param locationHash
      */
-    async handleCodeResponse(response, request) {
+    async handleCodeResponse(response, request, apiId) {
         this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponse, request.correlationId);
         let authCodeResponse;
         try {
@@ -13935,7 +13995,7 @@ class InteractionHandler {
                 throw e;
             }
         }
-        return invokeAsync(this.handleCodeResponseFromServer.bind(this), PerformanceEvents.HandleCodeResponseFromServer, this.logger, this.performanceClient, request.correlationId)(authCodeResponse, request);
+        return invokeAsync(this.handleCodeResponseFromServer.bind(this), PerformanceEvents.HandleCodeResponseFromServer, this.logger, this.performanceClient, request.correlationId)(authCodeResponse, request, apiId);
     }
     /**
      * Process auth code response from AAD
@@ -13945,7 +14005,7 @@ class InteractionHandler {
      * @param networkModule
      * @returns
      */
-    async handleCodeResponseFromServer(authCodeResponse, request, validateNonce = true) {
+    async handleCodeResponseFromServer(authCodeResponse, request, apiId, validateNonce = true) {
         this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponseFromServer, request.correlationId);
         this.logger.trace("InteractionHandler.handleCodeResponseFromServer called");
         // Assign code to request
@@ -13971,7 +14031,7 @@ class InteractionHandler {
             }
         }
         // Acquire token with retrieved code.
-        const tokenResponse = (await invokeAsync(this.authModule.acquireToken.bind(this.authModule), PerformanceEvents.AuthClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(this.authCodeRequest, authCodeResponse));
+        const tokenResponse = (await invokeAsync(this.authModule.acquireToken.bind(this.authModule), PerformanceEvents.AuthClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(this.authCodeRequest, apiId, authCodeResponse));
         return tokenResponse;
     }
     /**
@@ -14519,7 +14579,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      */
     async cacheAccount(accountEntity, correlationId, kmsi) {
         // Store the account info and hence `nativeAccountId` in browser cache
-        await this.browserStorage.setAccount(accountEntity, this.correlationId, kmsi);
+        await this.browserStorage.setAccount(accountEntity, this.correlationId, kmsi, this.apiId);
         // Remove any existing cached tokens for this account in browser storage
         this.browserStorage.removeAccountContext(AccountEntity.getAccountInfo(accountEntity), correlationId);
     }
@@ -14548,7 +14608,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             idToken: cachedIdToken,
             accessToken: cachedAccessToken,
         };
-        return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, isKmsi(idTokenClaims), request.storeInCache);
+        return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, isKmsi(idTokenClaims), this.apiId, request.storeInCache);
     }
     getExpiresInValue(tokenType, expiresIn) {
         return tokenType === AuthenticationScheme.POP
@@ -14923,7 +14983,7 @@ async function handleResponseCode(request, response, codeVerifier, apiId, config
     // Create popup interaction handler.
     const interactionHandler = new InteractionHandler(authClient, browserStorage, authCodeRequest, logger, performanceClient);
     // Handle response from hash string.
-    const result = await invokeAsync(interactionHandler.handleCodeResponse.bind(interactionHandler), PerformanceEvents.HandleCodeResponse, logger, performanceClient, request.correlationId)(response, request);
+    const result = await invokeAsync(interactionHandler.handleCodeResponse.bind(interactionHandler), PerformanceEvents.HandleCodeResponse, logger, performanceClient, request.correlationId)(response, request, apiId);
     return result;
 }
 /**
@@ -14970,7 +15030,7 @@ async function handleResponseEAR(request, response, apiId, config, authority, br
         cloud_instance_name: decryptedData.cloud_instance_name,
         msgraph_host: decryptedData.msgraph_host,
     };
-    return (await invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, logger, performanceClient, request.correlationId)(decryptedData, authority, nowSeconds(), request, additionalData, undefined, undefined, undefined, undefined));
+    return (await invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, logger, performanceClient, request.correlationId)(decryptedData, authority, nowSeconds(), request, apiId, additionalData, undefined, undefined, undefined, undefined));
 }
 /*
@@ -16784,7 +16844,7 @@ class SilentRefreshClient extends StandardInteractionClient {
             account: silentRequest.account,
         });
         // Send request to renew token. Auth module will throw errors if token cannot be renewed.
-        return invokeAsync(refreshTokenClient.acquireTokenByRefreshToken.bind(refreshTokenClient), PerformanceEvents.RefreshTokenClientAcquireTokenByRefreshToken, this.logger, this.performanceClient, request.correlationId)(silentRequest).catch((e) => {
+        return invokeAsync(refreshTokenClient.acquireTokenByRefreshToken.bind(refreshTokenClient), PerformanceEvents.RefreshTokenClientAcquireTokenByRefreshToken, this.logger, this.performanceClient, request.correlationId)(silentRequest, ApiId.acquireTokenSilent_silentFlow).catch((e) => {
             e.setCorrelationId(this.correlationId);
             serverTelemetryManager.cacheFailedRequest(e);
             throw e;
@@ -16828,12 +16888,13 @@ class SilentRefreshClient extends StandardInteractionClient {
  * Token cache manager
  */
 class TokenCache {
-    constructor(configuration, storage, logger, cryptoObj) {
+    constructor(configuration, storage, logger, cryptoObj, performanceClient) {
         this.isBrowserEnvironment = typeof window !== "undefined";
         this.config = configuration;
         this.storage = storage;
         this.logger = logger;
         this.cryptoObj = cryptoObj;
+        this.performanceClient = performanceClient;
     }
     // Move getAllAccounts here and cache utility APIs
     /**
@@ -16848,30 +16909,37 @@ class TokenCache {
             throw createBrowserAuthError(nonBrowserEnvironment);
         }
         const correlationId = request.correlationId || createNewGuid();
-        const idTokenClaims = response.id_token
-            ? extractTokenClaims(response.id_token, base64Decode)
-            : undefined;
-        const kmsi = isKmsi(idTokenClaims || {});
-        const authorityOptions = {
-            protocolMode: this.config.auth.protocolMode,
-            knownAuthorities: this.config.auth.knownAuthorities,
-            cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
-            authorityMetadata: this.config.auth.authorityMetadata,
-            skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache,
-        };
-        const authority = request.authority
-            ? new Authority(Authority.generateAuthority(request.authority, request.azureCloudOptions), this.config.system.networkClient, this.storage, authorityOptions, this.logger, request.correlationId || createNewGuid())
-            : undefined;
-        const cacheRecordAccount = await this.loadAccount(request, options.clientInfo || response.client_info || "", correlationId, idTokenClaims, authority);
-        const idToken = await this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, correlationId, kmsi);
-        const accessToken = await this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options, correlationId, kmsi);
-        const refreshToken = await this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, correlationId, kmsi);
-        return this.generateAuthenticationResult(request, {
-            account: cacheRecordAccount,
-            idToken,
-            accessToken,
-            refreshToken,
-        }, idTokenClaims, authority);
+        const rootMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.LoadExternalTokens, correlationId);
+        try {
+            const idTokenClaims = response.id_token
+                ? extractTokenClaims(response.id_token, base64Decode)
+                : undefined;
+            const kmsi = isKmsi(idTokenClaims || {});
+            const authorityOptions = {
+                protocolMode: this.config.auth.protocolMode,
+                knownAuthorities: this.config.auth.knownAuthorities,
+                cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
+                authorityMetadata: this.config.auth.authorityMetadata,
+                skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache,
+            };
+            const authorityString = request.authority || this.config.auth.authority;
+            const authority = await createDiscoveredInstance(Authority.generateAuthority(authorityString, request.azureCloudOptions), this.config.system.networkClient, this.storage, authorityOptions, this.logger, correlationId, this.performanceClient);
+            const cacheRecordAccount = await invokeAsync(this.loadAccount.bind(this), PerformanceEvents.LoadAccount, this.logger, this.performanceClient, correlationId)(request, options.clientInfo || response.client_info || "", correlationId, authority, idTokenClaims);
+            const idToken = await invokeAsync(this.loadIdToken.bind(this), PerformanceEvents.LoadIdToken, this.logger, this.performanceClient, correlationId)(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, correlationId, kmsi);
+            const accessToken = await invokeAsync(this.loadAccessToken.bind(this), PerformanceEvents.LoadAccessToken, this.logger, this.performanceClient, correlationId)(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options, correlationId, kmsi);
+            const refreshToken = await invokeAsync(this.loadRefreshToken.bind(this), PerformanceEvents.LoadRefreshToken, this.logger, this.performanceClient, correlationId)(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, correlationId, kmsi);
+            rootMeasurement.end({ success: true }, undefined, AccountEntity.getAccountInfo(cacheRecordAccount));
+            return this.generateAuthenticationResult(request, {
+                account: cacheRecordAccount,
+                idToken,
+                accessToken,
+                refreshToken,
+            }, authority, idTokenClaims);
+        }
+        catch (error) {
+            rootMeasurement.end({ success: false }, error);
+            throw error;
+        }
     }
     /**
      * Helper function to load account to msal-browser cache
@@ -16882,23 +16950,23 @@ class TokenCache {
      * @param requestHomeAccountId
      * @returns `AccountEntity`
      */
-    async loadAccount(request, clientInfo, correlationId, idTokenClaims, authority) {
+    async loadAccount(request, clientInfo, correlationId, authority, idTokenClaims) {
         this.logger.verbose("TokenCache - loading account");
         if (request.account) {
             const accountEntity = AccountEntity.createFromAccountInfo(request.account);
-            await this.storage.setAccount(accountEntity, correlationId, isKmsi(idTokenClaims || {}));
+            await this.storage.setAccount(accountEntity, correlationId, isKmsi(idTokenClaims || {}), ApiId.loadExternalTokens);
             return accountEntity;
         }
-        else if (!authority || (!clientInfo && !idTokenClaims)) {
-            this.logger.error("TokenCache - if an account is not provided on the request, authority and either clientInfo or idToken must be provided instead.");
+        else if (!clientInfo && !idTokenClaims) {
+            this.logger.error("TokenCache - if an account is not provided on the request, clientInfo or idToken must be provided instead.");
             throw createBrowserAuthError(unableToLoadToken);
         }
         const homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authority.authorityType, this.logger, this.cryptoObj, idTokenClaims);
         const claimsTenantId = idTokenClaims?.tid;
-        const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
+        const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, authority.getPreferredCache(), claimsTenantId, undefined, // authCodePayload
         undefined, // nativeAccountId
         this.logger);
-        await this.storage.setAccount(cachedAccount, correlationId, isKmsi(idTokenClaims || {}));
+        await this.storage.setAccount(cachedAccount, correlationId, isKmsi(idTokenClaims || {}), ApiId.loadExternalTokens);
         return cachedAccount;
     }
     /**
@@ -16967,9 +17035,15 @@ class TokenCache {
             this.logger.verbose("TokenCache - no refresh token found in response");
             return null;
         }
+        const expiresOn = response.refresh_token_expires_in
+            ? response.refresh_token_expires_in + nowSeconds()
+            : undefined;
+        this.performanceClient.addFields({
+            extRtExpiresOnSeconds: expiresOn,
+        }, correlationId);
         this.logger.verbose("TokenCache - loading refresh token");
         const refreshTokenEntity = createRefreshTokenEntity(homeAccountId, environment, response.refresh_token, this.config.auth.clientId, response.foci, undefined, // userAssertionHash
-        response.refresh_token_expires_in);
+        expiresOn);
         await this.storage.setRefreshTokenCredential(refreshTokenEntity, correlationId, kmsi);
         return refreshTokenEntity;
     }
@@ -16981,7 +17055,7 @@ class TokenCache {
      * @param authority
      * @returns `AuthenticationResult`
      */
-    generateAuthenticationResult(request, cacheRecord, idTokenClaims, authority) {
+    generateAuthenticationResult(request, cacheRecord, authority, idTokenClaims) {
         let accessToken = "";
         let responseScopes = [];
         let expiresOn = null;
@@ -17074,7 +17148,7 @@ class SilentAuthCodeClient extends StandardInteractionClient {
                 msgraph_host: request.msGraphHost,
                 cloud_graph_host_name: request.cloudGraphHostName,
                 cloud_instance_host_name: request.cloudInstanceHostName,
-            }, silentRequest, false);
+            }, silentRequest, this.apiId, false);
         }
         catch (e) {
             if (e instanceof AuthError) {
@@ -17187,7 +17261,7 @@ class StandardController {
         };
         this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger, this.performanceClient, this.eventHandler);
         // Initialize the token cache
-        this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto);
+        this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto, this.performanceClient);
         this.activeSilentTokenRequests = new Map();
         // Register listener functions
         this.trackPageVisibility = this.trackPageVisibility.bind(this);
@@ -18017,7 +18091,7 @@ class StandardController {
         this.logger.verbose("hydrateCache called");
         // Account gets saved to browser storage regardless of native or not
         const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-        await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims));
+        await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims), ApiId.hydrateCache);
         if (result.fromNativeBroker) {
             this.logger.verbose("Response was from native broker, storing in-memory");
             // Tokens from native broker are stored in-memory
@@ -19295,7 +19369,7 @@ class NestedAppAuthController {
     async hydrateCache(result, request) {
         this.logger.verbose("hydrateCache called");
         const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-        await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims));
+        await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims), ApiId.hydrateCache);
         return this.browserStorage.hydrateCache(result, request);
     }
 }